BonkDAO Loses $20M After Malicious Governance Vote

BonkDAO reported on July 7 that a governance proposal removed about $20 million worth of BONK from its treasury. The proposal executed before community signers could intervene.

Investigators found attackers bought roughly $4 million in BONK on exchanges before the vote and concentrated voting power into a small number of addresses. Voting records show a limited set of addresses held the majority of the voting influence that approved the proposal and triggered execution of treasury transfers.

BonkDAO identified exchange wallets used to purchase BONK ahead of the vote and is working with exchanges, bridge operators, the Solana Foundation and law enforcement to trace funds and seek recovery. Tracing efforts focus on exchange inflows and wallets tied to the voting addresses.

In public comments, BonkDAO described the proposal as ‘malicious.’ The DAO reported that the proposal moved BONK out of the treasury through its own governance process.

Security reviewers and the DAO point to token-weighted voting and low voter participation as the vulnerability that allowed the proposal to pass and execute. When approval is based solely on token votes without additional delays or checkpoints, concentrated holdings can enable direct access to treasury assets.

BonkDAO is considering several governance changes. Options under review include execution delays such as timelocks, higher quorum thresholds, formal proposal review windows, alerts for voting concentration, multisignature or council checkpoints, and splitting treasury assets into separate buckets so a single vote can move only a limited portion.

The BONK-denominated treasury was intended to fund on-chain utility, Solana public goods, grants, integrations and community programs. Investigations into the transfers remain active and the DAO continues its review of governance controls.